docs+refactor(client): fidelity pass — id identity, drop connections, no faux-login, accurate NextGraph framing

Align the polyfill's surface and docs with the verified NextGraph reality and
remove application-level concepts:

- Identity is an ID, not a username: AccountRecord.id, shim predicate shim:id,
  normalizeId; accounts core becomes IdentityStore (set/clear/get) — the faux
  login/logout framing is gone (identity is set at wallet-import time).
- Relationship/connection is an application concept, not a platform primitive
  (NextGraph has no bilateral-connection primitive: grantee is unpersisted
  scaffolding, cap-send is unimplemented). Remove connections.ts; caps exposes
  only a directed grantRead(doc, granteeId) + a read-only protectedDocsOf(owner).
  Delete the now-dead isolation.ts social-visibility axis.
- Inbox docs: NextGraph has no separate curator — the recipient's own verifier
  unseals and applies each queued sealed message inline (process_inbox);
  inbox_post_link is a proposed/future API. Stop attributing the emulated
  curator to the platform.
- Read isolation reframed around the outcome: no cap -> empty union read;
  targeted read of an unheld repo -> RepoNotFound; cap introspection
  (canRead/governsRead) is emulation-only with no NextGraph API behind it.
- read-model.md corrected: the listing path is per-doc ANCHORED default-graph
  queries, never the anchorless GRAPH ?g union (that is O(wallet)); the probe
  section no longer claims the opposite.
- README recap table restructured (target | current NextGraph status | current
  emulation); INDEX_ACCOUNT documented as reservedAccount("index") in the
  sentinel namespace; de-domained generic-layer comments; softened tone.

Consumer application (Festipod) rewired separately to own the relationship
concept and feed the lib an id. Lib gates: bun test 83 pass / 0 fail, tsc clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

packages/client/src/docs.ts

@@ -1,12 +1,13 @@
 /**
  * Low-level document + SPARQL primitives.
  *
- * These call the **REAL injected `ng`** (`getConfig().ng`) DIRECTLY — never the
- * public `ng` proxy (`makeNg`). This is a validated hard constraint, NOT a style
+ * These call the real injected `ng` (`getConfig().ng`) directly — never the
+ * public `ng` proxy (`makeNg`). This is a validated hard constraint, not a style
  * choice: the public `ng` is a JS `Proxy` over `@ng-org/web`'s iframe-RPC proxy,
  * and layering our Proxy on top breaks `doc_create`'s `postMessage` marshaling
- * (`DataCloneError: function ... could not be cloned`). Reaching the real `ng`
- * held in the config avoids the double-proxy. Do NOT import from `./ng-proxy`.
+ * with **`DataCloneError: function ... could not be cloned`** — the footgun this
+ * rule exists to prevent. Reaching the real `ng` held in the config avoids the
+ * double-proxy. Do not import from `./ng-proxy`.
  *
  * Signatures mirror the real `@ng-org/web` `ng` surface (verified against the
  * app's storeRegistry usage), so this is a drop-in for those raw calls.